pipeline: table entry parser accepts actions not belonging to the table

https://bugs.dpdk.org/show_bug.cgi?id=2104

Bug ID: 2104
Summary: pipeline: table entry parser accepts actions not
belonging to the table
Product: DPDK
Version: 26.11
Hardware: All
OS: All
Status: UNCONFIRMED
Severity: major
Priority: Normal
Component: other
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---

Found by build with GCC 16 and -fanalyzer flag.

rte_swx_ctl_pipeline_table_entry_read() (lib/pipeline/rte_swx_ctl.c:3131) finds the action with action_find(ctl, tokens[1]), which searches all pipeline actions. It does not check that the action is one of the table's actions. entry->action_data is allocated from table->params.action_data_size (:321), or left NULL when that is 0. table_entry_action_argument_read() (:2896) then copies the arguments into it. An entry line naming an action with more argument bytes than the table allows writes past the buffer, or to NULL.

You are receiving this mail because:
You are the assignee for the bug.